CVE-2026-125883
CriticalCVSS 9.3Summary
N-able N-central before version 26.4.1 is vulnerable to improper restriction of XML external entity references, allowing XML Schema Poisoning. The issue affects versions prior to 26.4.1.
Risk Assessment
An attacker could manipulate XML processing in the management system, potentially causing unexpected application behavior or data exposure. This impacts the integrity of the monitoring and management platform.
Recommendation
Update N-able N-central to version 26.4.1 or later. Until patched, consider restricting access to interfaces that process XML.
Other vulnerabilities in N-able N-central
See all- CVE-2026-91000High
A missing authentication for critical function vulnerability in N-able N-central allows Privilege Escalation. This issue affects N-central before 2026.4.1.
- CVE-2026-125958High
A download of code without integrity check vulnerability in N-able N-central allows Remote Code Inclusion. This issue affects N-central through 24.6.1.
- CVE-2026-125882High
N-able N-central contains a relative path traversal vulnerability that allows an attacker to manipulate file access paths. This issue affects N-central versions before 26.4.1.
- CVE-2026-125880High
N-able N-central contains a Cross-Site Scripting (XSS) vulnerability caused by improper neutralization of HTTP headers for scripting syntax. This issue affects N-central versions before 26.4.1.
- CVE-2026-125879High
N-able N-central contains an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects N-central versions before 26.4.1.
- CVE-2026-125878High
N-able N-central contains a cross-site scripting vulnerability caused by improper neutralization of input during web page generation, allowing resource injection. This issue affects N-central versions before 26.4.1.
- CVE-2026-125881Critical
N-able N-central before version 26.4.1 contains a Server-Side Request Forgery (SSRF) vulnerability that allows an attacker to force server-side requests. The issue affects versions prior to 26.4.1.
- CVE-2026-18556HighActively exploited
Authentication bypass using an alternate path or channel vulnerability in N-able N-central through version 2026.1 allows authentication bypass.
- CVE-2025-8876HighActively exploited
Improper Input Validation vulnerability in N-able N-central allows OS Command Injection. This issue affects N-central before 2025.3.1.
- CVE-2025-8875HighActively exploited
Deserialization of untrusted data vulnerability in N-able N-central allows local code execution. Affects versions before 2025.3.1.
Original NVD description (English source)
Improper restriction of XML external entity reference vulnerability in N-able N-central allows XML Schema Poisoning. This issue affects N-central: before 26.4.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS